vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

cbfs: Check for ptr range sanity.

Browse source 
Triaged by Andrei and enhanced with suggestions by Aaron Durbin
Also-By: Andrei Borzenkov <arvidjaar@gmail.com>
This commit is contained in:
Vladimir Serbinenko 2015-11-08 20:34:30 +01:00
parent a39137aefe
commit 855fe6869c
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
grub-core/fs/cbfs.c
View file

@ -344,8 +344,16 @@ init_cbfsdisk (void)
ptr = *(grub_uint32_t *) 0xfffffffc;
head = (struct cbfs_header *) (grub_addr_t) ptr;
grub_dprintf ("cbfs", "head=%p\n", head);
if (!validate_head (head))
/* coreboot current supports only ROMs <= 16 MiB. Bigger ROMs will
have problems as RCBA is 18 MiB below end of 32-bit typically,
so either memory map would have to be rearranged or we'd need to support
reading ROMs through controller directly.
*/
if (ptr < 0xff000000
|| 0xffffffff - ptr < sizeof (*head) + 0x10
|| !validate_head (head))
return;
cbfsdisk_size = ALIGN_UP (grub_be_to_cpu32 (head->romsize),